c26fdfed1dc44dda3a807cb6bb173de05c893f0e0b57d2dc78213938239f9c91

Analysis

max time kernel
158s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06-01-2024 23:08

Target

4768177f5fc78eb94158d28beb02256b.dll
Size

131KB
MD5

4768177f5fc78eb94158d28beb02256b
SHA1

dbef7579a60adc48e7b2ee3eb8eb88ac02321769
SHA256

c26fdfed1dc44dda3a807cb6bb173de05c893f0e0b57d2dc78213938239f9c91
SHA512

a5261ac2cd4b05b0e4b04259d2d1575bcffaf30764234d83ce42093626cb13b4a1d27f391acb4bd79572abb6dab536180521d33a0443715b9208972a1bec8f5b
SSDEEP

3072:R/2W7kEhM+DhEkLIFaOjLPDuf2Fm4bmX+Esh03k9Yxekfw9KYG:dtNekEFaKufaDbmm00J

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3040	2060	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 2060	1480	rundll32.exe	88
PID 1480 wrote to memory of 2060	1480	rundll32.exe	88
PID 1480 wrote to memory of 2060	1480	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4768177f5fc78eb94158d28beb02256b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4768177f5fc78eb94158d28beb02256b.dll,#1
  2⤵
  PID:2060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 828
    3⤵
    - Program crash
    PID:3040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2060 -ip 2060
1⤵
PID:4600